Ransomware is a class of malware that blackmails users by encrypting their files on computers and asking for a ransom to release the decryption key(s). Since the appearance of the first modern ransomware sample in 2006, ransomware have become quite sophisticated. In the United States alone, almost 13.1 million people got infected by ransomware and more than 50% of them have actually paid the extortionist. It has been estimated that, only in 2015, ransomware caused $350 million in damage. This proves that actual detection based on signature techniques are not effective against the ransomware threat and that ransomware is a lucrative business that keeps attracting new cybercriminals, as also shown by the increasing number of samples and families. In this work we propose RADAR, a system able to detect ransomware activity by monitoring processes, and to recover any affected file.